Last updated: April 2, 2026
RockSpin ("the App") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard your information when you use our mobile application.
We collect the following information to provide our services:
Through Apple Authentication ("Sign in with Apple"):
• Required: A unique, anonymized Apple User Identifier (Subject sub).
• Optional: Your email address, only if you choose to share it during the sign-in process.
Through Guest AI Access:
• A random app installation identifier generated by RockSpin and used for guest AI quota and abuse prevention.
• Limited guest AI generation records, including timestamps and rate-limit metadata.
Through App Usage:
• Favorite samples saved to your account.
• Credit balance and transaction history (purchase, usage, refund records).
• AI Playground usage data: prompts, generated images, session history.
• Optional reference images you select within the AI Playground for analysis or editing.
• Gallery activity: likes, saves, and reports on shared content.
Information We Do NOT Collect:
• Location data
• Health or fitness data
• Financial information (payments are processed entirely by Apple)
• Contacts or address book
• Browsing history
• Device diagnostic data
We use the information we collect for the following purposes:
• To Create and Manage Your Account: To identify you as a user and provide access to account-specific features.
• To Provide Services: To enable AI Playground, Favorites, public Gallery publishing, and credit management.
• To Enforce Guest Limits: To provide limited AI generation without registration while preventing abuse and excessive automated use.
• To Process Transactions: To manage credit balances and record usage history. Payment processing is handled entirely by Apple; we do not receive or store payment card information.
• To Maintain Community Safety: To review reports, enforce Gallery rules, hide or remove violating content, and restrict abusive creators when needed.
• To Improve Our Services: To analyze usage patterns and improve the App experience.
If you publish AI-generated images to the public Gallery:
• Other users may view, like, save, share, and download that public Gallery content for personal, non-commercial learning use.
• Users may report public Gallery content that they believe violates our rules.
• We may review reports, hide content pending review, remove content, or restrict a creator's ability to publish when necessary to protect the service.
• We may retain report records, moderation notes, and enforcement history as reasonably necessary to investigate abuse, respond to user concerns, and enforce our Terms of Service.
RockSpin uses the following third-party services:
• Apple (Sign in with Apple) — Authentication: Apple User ID, optional email
• Apple Music / MusicKit — Optional playlist access and playback for Turntable mode. Playlist and subscription checks are used on-device to let you choose and play music, and are not used for advertising.
• AWS (Amazon Web Services) — Server hosting, image storage: App data, images
• AI Service Providers — Image generation and reference image analysis: text prompts and optional reference images you select within the AI Playground
We do not share your personal information with third parties for advertising or marketing purposes.
We retain your personal information for as long as your account is active. If you choose to delete your account using the "Delete Account" feature within the App:
• Your active account records and AI Playground records are removed from our active application databases.
• Cleanup of associated files in object storage is initiated at the same time. If operational cleanup cannot be completed immediately, it may finish through follow-up maintenance processes.
• Cleanup queue records may remain until retry or maintenance processing is complete.
• Billing security records — including StoreKit transaction ledgers, signup bonus eligibility records, purchase identity tokens, and related audit metadata — may be retained as reasonably necessary to prevent fraud, enforce entitlement rules, resolve refund or purchase disputes, and satisfy accounting or legal obligations.
• Report records and moderation history may be retained for a reasonable period if needed to investigate abuse, respond to legal obligations, or enforce our Terms of Service.
• Data in secure backup archives may be retained until normal backup rotation completes, for up to 1 year.
• Remaining credits are forfeited upon account deletion (see Section 7 of the Terms of Service).
We implement industry-standard security measures to protect your data:
• HTTPS/TLS encryption for all data transmission
• JWT-based authentication with secure token storage
• Server-side rate limiting and input validation
• AWS infrastructure with access controls
Data Breach Notification:
In the event of a personal data breach that poses a risk to your rights and freedoms, we will:
• Notify affected users via email (if available) and in-app notification within 72 hours of confirming the breach.
• Notify relevant data protection authorities as required by applicable law.
• Provide information about: the nature of the breach, categories and approximate number of individuals affected, likely consequences, measures taken to address the breach, and contact point for more information.
To report a security concern: rockspin@hydromo.dev
RockSpin is rated 4+ and is designed as an educational tool. We do not knowingly collect personal information from children under 13 (United States) or under 14 (Republic of Korea). If a parent or guardian becomes aware that their child has provided personal information without consent, please contact us at rockspin@hydromo.dev and we will promptly delete such information.
Your data may be stored and processed on servers located outside your country of residence (AWS infrastructure in the United States). By using the App, you consent to the transfer of your information to these servers.
For Korean Users: In accordance with Article 17 of the Personal Information Protection Act (PIPA), your personal information is transferred to AWS servers located in the United States for the purpose of providing our services. Transferred items: Apple User ID, email (optional), service usage records. Data processor: Amazon Web Services, Inc.
For EU Users: Data transfers outside the EEA are conducted in compliance with GDPR Article 46 using Standard Contractual Clauses (SCCs) implemented by AWS.
United States — California Residents (CCPA/CPRA):
• Right to Know: You may request disclosure of the categories and specific pieces of personal information we have collected about you.
• Right to Delete: You may request deletion of your personal information. Use the "Delete Account" feature in the App, or contact us at rockspin@hydromo.dev.
• Right to Opt-Out of Sale: We do not sell your personal information. No opt-out action is required.
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.
To exercise your rights, contact: rockspin@hydromo.dev. We will respond within 45 days.
Republic of Korea — Personal Information Protection Act (PIPA):
• Right to Access: You may request to view your collected personal information.
• Right to Correction/Deletion: You may request correction or deletion of inaccurate personal information.
• Right to Suspension of Processing: You may request suspension of personal information processing.
• Right to Withdraw Consent: You may withdraw consent for the collection and use of personal information at any time.
Data Protection Officer: rockspin@hydromo.dev
To exercise your rights: Contact rockspin@hydromo.dev or use the "Delete Account" feature in the App. We will respond within 10 days.
European Union — GDPR:
• Right of Access (Art. 15): Request a copy of your personal data.
• Right to Rectification (Art. 16): Request correction of inaccurate data.
• Right to Erasure (Art. 17): Request deletion of your data ("right to be forgotten").
• Right to Data Portability (Art. 20): Request your data in a machine-readable format.
• Right to Object (Art. 21): Object to processing based on legitimate interests.
• Right to Withdraw Consent (Art. 7): Withdraw consent at any time.
Legal Basis for Processing: Consent (Art. 6(1)(a)) and Contract Performance (Art. 6(1)(b)).
Data Controller: RockSpin (rockspin@hydromo.dev).
To exercise your rights, contact: rockspin@hydromo.dev. We will respond within 30 days. You also have the right to lodge a complaint with your local Data Protection Authority.
We may update this Privacy Policy from time to time. We will notify users of significant changes through the App or via email (if provided). Continued use of the App after changes constitutes acceptance. Material changes will take effect 30 days after notice.
If you have any questions or concerns about this Privacy Policy, please contact us at:
• Email: rockspin@hydromo.dev